CVE Feed

    Dashboard / CVE / CVE-2026-48974

    CVE-2026-48974

    HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without requiring an owner role, an invitation token, target-user consent, or target-user notification. Any authenticated user can force another account into the caller's group, disclose the target user's email address and name through the resulting member list, and create the membership prerequisite used by a separate cross-group inventory-wipe vulnerability. This issue is fixed in version 0.26.0.

    Published:Sep 21, 2026
    Last Modified:Sep 29, 2026
    EPS:Sep 21, 2026
    EPSS Score:0.00294
    CVSS Score:5.4

    Affected Products

    Vendor
    Sysadminsmedia
    Product
    Homebox

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-85287 (CVSS 6.5) — HomeBox is a home inventory and organization system. Prior to 0.27.0, POST /api/v1/users/register and the user…
    CVE-2026-75599 (CVSS 5.4) — HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl() utility accepts markdown-…
    CVE-2026-85286 (CVSS 3.7) — HomeBox is a home inventory and organization system. Prior to 0.27.0, the POST /api/v1/users/login endpoint pe…
    CVE-2026-116680 (CVSS 6.4) — HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifi…
    CVE-2026-55473 (CVSS 6) — HomeBox is a home inventory and organization system. Prior to 0.26.0, the default-on BlockBogonNets and BlockC…
    CVE-2026-48826 (CVSS 8.1) — HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/h…
    CVE-2026-48975 (CVSS 8.1) — HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and Ma…
    CVE-2026-48976 (CVSS 8.1) — HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/int…
    CVE-2026-40196 (CVSS 8.1) — HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where th…
    CVE-2026-27981 (CVSS 7.4) — HomeBox is a home inventory and organization system. Prior to 0.24.0, the authentication rate limiter (authRat…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High